Overview

overview

10

Static

static

10

2026-10-22...om.exe

windows10-2004-x64

7

2026-10-22...om.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/10/2026, 22:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-22_0c6400a1cfc453016fd6c70c5c608738_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 40.2MB
  • Sample261024-1xpllaev2q
  • SHA256 9208c7ffe6d95902a37302d14a25610828e3793602b1470ae616dec820bfad62
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionspywarestealer

Malware Config

Signatures

  • Loads dropped DLL 60 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Queries system WMI classes for hardware identifiers 2 TTPs 4 IoCs

    Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

    discovery
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-22_0c6400a1cfc453016fd6c70c5c608738_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-22_0c6400a1cfc453016fd6c70c5c608738_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4836
    • C:\Users\Admin\AppData\Local\Temp\2026-10-22_0c6400a1cfc453016fd6c70c5c608738_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-10-22_0c6400a1cfc453016fd6c70c5c608738_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1532
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"
        3⤵
        • Queries system WMI classes for hardware identifiers
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2864
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "(Get-WmiObject -Class Win32_BIOS).SerialNumber"
        3⤵
        • Queries system WMI classes for hardware identifiers
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5228
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "(Get-WmiObject -Class Win32_BaseBoard).SerialNumber"
        3⤵
        • Queries system WMI classes for hardware identifiers
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3356
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "(Get-WmiObject -Class Win32_Processor).ProcessorId"
        3⤵
        • Queries system WMI classes for hardware identifiers
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5704
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "(Get-WmiObject -Class Win32_BIOS).OEMStringArray"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2620
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "(Get-WmiObject -Class Win32_SystemEnclosure).SMBIOSAssetTag"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2988
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:3276

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\VCRUNTIME140.dll
          • Size 174KB
          • SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\VCRUNTIME140_1.dll
          • Size 48KB
          • SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _asyncio.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\_asyncio.pyd
          • Size 71KB
          • SHA256 6654dfbf4cc92609801f35022acaddd3fc19e6c777b7771b0f0a68f5813889a8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\_bz2.pyd
          • Size 84KB
          • SHA256 6da4d453852346299e983b458f3ec2f0db3b5f765998ba3f45c91b4a1549037b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\_ctypes.pyd
          • Size 131KB
          • SHA256 5bcddf4c374c4d247e1e4a61f3347159c36c5785fe43bdae11a4e6c9ea2c0166
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\_hashlib.pyd
          • Size 67KB
          • SHA256 4d3eb9d9492d626c7bb10cfe5ab233a9195ec7b27e92b465b287e7a24fc8266c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\_lzma.pyd
          • Size 155KB
          • SHA256 2b4dcb12c0420ffced4b91968ae4eff6cb585f0f07490160c6da47da63064a99
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _overlapped.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\_overlapped.pyd
          • Size 56KB
          • SHA256 3f393b2ce1fe5973fc45e49dffcf51405fa875cdb284cf96b2f0d4b93b08765c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\_queue.pyd
          • Size 34KB
          • SHA256 79c196a0804b152fc48b4055387f4352838e41c28863a0c946e7a98137e681e1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\_socket.pyd
          • Size 84KB
          • SHA256 c5936292083189e0675a96ddd0e38235726f1c58195cec64eb0085b9c479ddce
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\_ssl.pyd
          • Size 186KB
          • SHA256 30ff82a3ea0c675ddc99e6b14f71ca750f06e77d6653e2da3d7d35b7ef0fc2ed
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _uuid.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\_uuid.pyd
          • Size 27KB
          • SHA256 0d6fcf704721d4bae58cc754b15a3f8c36907b718874f6d7cbbaa363a14618b1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _wmi.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\_wmi.pyd
          • Size 38KB
          • SHA256 f88c322f871aef92de562278bd25c34c6e758642669d5512a22ed972840317b1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _http_parser.cp313-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\aiohttp\_http_parser.cp313-win_amd64.pyd
          • Size 296KB
          • SHA256 bb8bcd68b7009591cabc1803c7f4dccc0f042436111f5ed64f4a7cb274504f43
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _http_writer.cp313-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\aiohttp\_http_writer.cp313-win_amd64.pyd
          • Size 42KB
          • SHA256 13e78832a64448a0877e649d73af6d3d63ae904e9367419db972443d3b1de855
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mask.cp313-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\aiohttp\_websocket\mask.cp313-win_amd64.pyd
          • Size 34KB
          • SHA256 082e86dc556edf3292c98f724adbcd72175129a9dd2da1e3c0fcb2efb977afad
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          reader_c.cp313-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\aiohttp\_websocket\reader_c.cp313-win_amd64.pyd
          • Size 147KB
          • SHA256 b0f2aef55414b41fd435ba46115dd92b66cbf4484e1ffed6673db1f9920951b1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\base_library.zip
          • Size 1.3MB
          • SHA256 9bf288475623b1be232b7593766d251a8dcaec3f64873d773b66c49c308ac44a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cd.cp313-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\charset_normalizer\cd.cp313-win_amd64.pyd
          • Size 112KB
          • SHA256 9cccc0b9eb9f514f25cf21d9a8f09948506978ffa19d80ccd6be8df9a9890095
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          md.cp313-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\charset_normalizer\md.cp313-win_amd64.pyd
          • Size 201KB
          • SHA256 b484d0fc3d09e52a4974f4aebfc8f79cc5e4f38e375d76402b93905f03f803b1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\libcrypto-3.dll
          • Size 5.7MB
          • SHA256 75495fe0e079ab00d49be740d3c710a0b94e3f74f9648cb7cc9f768fc7f52319
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\libffi-8.dll
          • Size 38KB
          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libssl-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\libssl-3.dll
          • Size 1.2MB
          • SHA256 8957182a9c385bfd9f3f790921de2ddc614cf91f99edbed4e9e5446a46504e32
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _multidict.cp313-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\multidict\_multidict.cp313-win_amd64.pyd
          • Size 125KB
          • SHA256 329fc90ad253591fed1ed6a9756d953d918b1ff5169df5e769c6553ddeba9001
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          INSTALLER
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\numpy-2.5.4.dist-info\INSTALLER
          • Size 4B
          • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
          • MD5 SHA1 SHA512
          Submit Download

          _helpers_c.cp313-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\propcache\_helpers_c.cp313-win_amd64.pyd
          • Size 63KB
          • SHA256 fbdee8b2d39867f69e779662efcf986747f496c83373fa5c8990f9e150a779df
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python3.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\python3.DLL
          • Size 70KB
          • SHA256 a1a32b2475675e784d9b34d33d3a8f3e4afaa563da1feb784b0dd69fc4d8f9dc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python313.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\python313.dll
          • Size 5.9MB
          • SHA256 3b29bf9ff39bed8f660f5b935f19657f7ce7f145009851741b11364f6ebcb862
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pywintypes313.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\pywin32_system32\pywintypes313.dll
          • Size 133KB
          • SHA256 ea82e185e0bed58485a8df23712b62224f5e486dbb84d946115cad17512065cb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\select.pyd
          • Size 32KB
          • SHA256 17df388a7aa42e7f066b80aa4f77cbbba9286495e6f3508425806be6766d122b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Lorem ipsum.txt
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
          • Size 1KB
          • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\unicodedata.pyd
          • Size 695KB
          • SHA256 d113047658f92d893bf4ee2da81ffbd624ec5c485733c02e116fac1b9a1b964c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          win32api.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\win32\win32api.pyd
          • Size 135KB
          • SHA256 040d6a9ce12555d2585f89dce2aa4e25265c27dfa827eb9cae4c922e12ec731c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _quoting_c.cp313-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012e42\yarl\_quoting_c.cp313-win_amd64.pyd
          • Size 78KB
          • SHA256 5bfa1f08f916718a5c18373dc1c09a50cccf8a5cea70b01473dd76ce60d1f8fc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          __PSScriptPolicyTest_w3gzy0m3.b1g.psm1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w3gzy0m3.b1g.psm1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/1532-1168-0x000001B76A800000-0x000001B76B176000-memory.dmp
          Download

          memory/1532-1190-0x000001B76A800000-0x000001B76B176000-memory.dmp
          Download

          memory/2864-1162-0x00007FF99A5C0000-0x00007FF99AF64000-memory.dmp
          Download

          memory/2864-1160-0x00007FF99A5C0000-0x00007FF99AF64000-memory.dmp
          Download

          memory/2864-1161-0x00007FF99A5C0000-0x00007FF99AF64000-memory.dmp
          Download

          memory/2864-1154-0x00007FF99A74F000-0x00007FF99A750000-memory.dmp
          Download

          memory/2864-1163-0x00007FF99A5C0000-0x00007FF99AF64000-memory.dmp
          Download

          memory/2864-1164-0x00007FF99A5C0000-0x00007FF99AF64000-memory.dmp
          Download

          memory/2864-1167-0x00007FF99A5C0000-0x00007FF99AF64000-memory.dmp
          Download

          memory/2864-1166-0x00007FF99A5C0000-0x00007FF99AF64000-memory.dmp
          Download

          memory/2864-1159-0x00007FF99A5C0000-0x00007FF99AF64000-memory.dmp
          Download

          memory/2864-1158-0x0000018CFC230000-0x0000018CFC252000-memory.dmp
          Download

          memory/2864-1157-0x00007FF99A5C0000-0x00007FF99AF64000-memory.dmp
          Download